Binance Exposes Hackers’ Months-Long Planning in Billions-Dollar Crypto Theft

In September, an engineer was contacted through a legitimate job-hunting platform by someone posing as a project director seeking new hires. The impostor arranged a first-round interview with a fake HR representative and a second-round with the supposed CEO of a fictitious company.

During the initial video interview, the fraudulent HR representative shared a social media profile with personal content. The subsequent interview, conducted via a social chat app, required the engineer to download an “assignment” from a code repository. This repository contained malicious code that executed on the device during setup.

Binance stated that the malware employed advanced obfuscation and evasion techniques, including replacing a legitimate development tool with a malicious version to execute commands and communicate with an attacker-controlled server. This zero-day malware bypassed endpoint security detection at the time. The attacker also concealed malicious activity and removed traces, hindering investigation.

On October 20, the attackers used the compromised engineer’s computer and an internal AI tool to control two other engineer devices, including one previously targeted with a trojanized Homebrew installer. The engineer’s wallet contained a token granting access to container deployment.

Nine days later, between 17:15 and 19:56 UTC, the threat actor accessed a third engineer’s device with stolen credentials, deployed a container, and activated a script to initiate the transfer. The attackers also extended unauthorized access to an internal wallet signing service to complete transactions outside normal procedures.

Source link